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REMARKS 

Please reconsider the application in view of the above amendments and the following 
remarks. Applicants thank the Examiner for carefully considering this application. 

Disposition of the Claims 

Claims 27-47 are pending in the application. Claims 27, 34, and 41 are independent. The 
remaining claims depend, directly or indirectly, from the independent claims. 

Claim Amendments 

Claim 34 has been amended by this reply. Claim 34 has been amended to resolve a 
typographical error, because the word "retrieving" should have been "retrieve." Claim 34 has also 
been amended to clarify the subject matter of the claim. The phrase "and the second artifact" was 
added in error. Support for this amendment may be found, for example, on page 36 lines 1 1-16 of 
the Specification. No new matter is added by way of these amendments. These amendments are 
made in order to reduce issues on Appeal. Applicants have spoken with the Examiner regarding 
these amendments and the Examiner has agreed to enter these amendments. 

Rejections under 35 U.S.C. § 102 

Claims 27-31, 33-35, 37-38, 40-45, and 47 are rejected under 35 U.S.C. § 102(e) as being 
anticipated by U.S. Patent No. 7,010,582 ("Cheng"). To the extent this rejection applies to the 
pending claims, the rejection is respectfully traversed. 
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Independent claim 27 is directed to a method for managing access to a plurality of 
applications using artifacts and identity assertion information. More specifically, claim 27 requires, 
in part, (i) authenticating a user using a user name and password to a first application; (ii) generating 
identity assertion information based the successful authentication for use by a plurality of 
applications to authenticate the user ; (iii) providing the first application with a first artifact, where 
the first artifact is used to obtain the identity assertion information ; (iv) providing the first artifact to 
a second application, where the second application uses the first artifact to obtain the identity 
assertion information; (v) authenticating the user using the identity assertion information to the 
second application; (vi) generating a second artifact, where the first artifact is used to obtain the 
identity assertion information (i.e., the same identity assertion information mentioned in (iii)); and 
(vii) rendering the first artifact invalid for future use by any of the plurality of applications . 

Turning to the rejection "[a] claim is anticipated only if each and every element as set forth 
in the claim is found, either expressly or inherently described, in a single prior art reference." 
Verdegaal Bros. v. Union Oil Co. of California, 814 F.2d 628, 631 (Fed. Cir. 1987) (emphasis 
added). Further, "[t]he identical invention must be shown in as complete detail as is contained in 
the claim." Richardson v. Suzuki Motor Co., 868 F.2d 1226, 1236 (Fed. Cir. 1989). Further, 
"unless a reference discloses within the four corners of the document not only all of the limitations 
claimed but also all of the limitations arranged or combined in the same way as recited in the claim, 
it cannot be said to prove prior invention of the thing claimed, and, thus, cannot anticipate under 35 
U.S.C. § 102." NetMoneyIN, Inc. v. VeriSign, Inc., 2008 WL 4614511 (Fed. Cir. 2008). 

Applicants assert that Cheng fails to disclose each and every limitation of the pending 
independent claims. Specifically, Cheng discloses an authentication front-end configured to receive 
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a request to access a protected URL, where the request may contain a cookie. See Cheng col. 6 
lines 38-48. After authentication, a cookie is sent back to the user with redirect instructions to the 
protected URL that the user initially requested. The user may then use this cookie to access other 
servers within the domain. Accordingly, the cookie is (i) maintained by the user (or more 
specifically in the end user device); (ii) the cookie may be reused to access different servers; (iii) the 
cookie is used to directly authenticate the user to the server. 



The Examiner has attempted to equate cookie disclosed in Cheng to artifacts of the amended 
claims. See Office Action p. 6. The Applicants disagree. Specifically, artifacts may only be used 
for a single authentication, whereas the cookie in Cheng may be reused. At best, the cookie in 
Cheng may have an "expry date" (see, e.g., Cheng col. 7 lines 9-10). However, a cookie that 
expires at an "expry date" and a cookie that expires after a first use are not the same. Accordingly, 
as required by Richardson, the identical invention is not shown by the prior art. Further, artifacts 
themselves do not authenticate a user to an application; rather, the artifact is used to obtain the 
identity assertion information that is used to authenticate the user to the application; and the artifact 
is used to obtain the identity assertion information while the cookie in Cheng is not used to obtain 
any sort of information required for authentication as the cookie itself is provided for the purpose of 
authenticating the user. See Cheng col. 6, lines 54-59. 

Moreover, Cheng fails to disclose "receiving a request for a second artifact from the second 
application." See Final Rejection p. 7. Examiner cites col. 10 lines 42-46. However, this section of 
Cheng merely discloses sending a request to a second server where the request includes data to be 
transferred from a first server to the second server. As described above, Examiner equates the 
cookie of Cheng to the artifact of the claimed invention. As required by Net MoneyIN, in order for 
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Cheng to anticipate the limitations of the claimed invention, the limitations must be combined in the 
same way. Accordingly, in Cheng, a second cookie would have to be received by the second server. 
A review of Cheng reveals that Cheng is silent regarding receiving a second cookie at the second 
server. Accordingly, Cheng fails to disclose each and every element of claim 27. 

In view of the above, claim 27 is allowable over Cheng. Further, independent claims 34 and 
41 include similar limitations to claim 27 and, thus, are also not anticipated by Cheng for at least the 
same reasons. Accordingly, claims 27, 34, and 41 are allowable over Cheng. Further, claims 28-31, 
33, 35, 37-38, 40, 42-45, and 47 depend from the independent claims and, thus, are also allowable 
over Cheng for at least the same reasons. Accordingly, the rejection is traversed and withdrawal is 
respectfully requested. 

Rejections under 35 U.S.C. § 103 

Claims 32, 36, 39, and 46 are rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Cheng and in view of U.S. Patent Publication No. 2003/0177388 ("Botz"). To the extent this 
rejection applies to the pending claims, the rejection is respectfully traversed. 

MPEP § 2143 states that "[t]he key to supporting any rejection under 35 U.S.C. 103 is the 
clear articulation of the reason(s) why the claimed invention would have been obvious. The 
Supreme Court in KSR noted that the analysis supporting a rejection under 35 U.S.C. 103 should be 
made explicit." Further, when combining prior art elements, the Examiner "must articulate the 
following: (1) a finding that the prior art included each element claimed, although not necessarily in 
a single prior art reference, with the only difference between the claimed invention and the prior art 
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being the lack of actual combination of the elements in a single prior art reference...." MPEP 
§ 2143(A). 

Claims 32, 36, and 46 depend on independent claims 27, 34, and 41 respectively. As 
discussed above, Cheng fails to teach or suggest all the limitations of amended independent claims 
27, 34, and 41. Further, Botz fails to teach or suggest that which Cheng lacks. This is evidenced by 
the fact that Botz is only relied upon to teach SAML and that the identity assertion information is 
stored in the identity service provider. See Office Action mailed March 27, 2008, p. 7. 

In view of the above, the Examiner has failed to produce a prima facie case of obviousness 
because Cheng and Botz, viewed separately or in combination, fail to teach or suggest each and 
every limitation of independent claims 27, 34, and 41. Therefore, independent claims 27, 34, and 
41 are patentable over Cheng and Botz, for at least the reasons given above. Claims 32, 36, 39, and 
46 depend, directly or indirectly, from the independent claims and are patentable over Cheng and 
Botz for at least the same reasons. Accordingly, the rejection is respectfully traversed and 
withdrawal is respectfully requested. 
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Applicants believe this reply is fully responsive to all outstanding issues and places 
this application in condition for allowance. If this belief is incorrect, or other issues arise, the 
Examiner is encouraged to contact the undersigned or his associates at the telephone number listed 
below. Please apply any charges not covered, or any credits, to Deposit Account 50-0591 
(03226/475001; P8956). 



Dated: January 2, 2009 Respectfully submitted, 



By /Robert P. Lord/ 

Robert P. Lord 
Registration No.: 46,479 
OSHA • LIANG LLP 
909 Fannin Street, Suite 3500 
Houston, Texas 77010 
(713) 228-8600 
(713) 228-8778 (Fax) 
Attorney for Applicants 
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